Merge pull request #907 from franbuehler/sqli-rulerevision2

emphazer · web-flow · commit 6f8d10d6426e · 2017-10-31T22:37:14.000+01:00
sqli rulerevision: disassembling sqli rules
diff --git a/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf b/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
diff --git a/util/regexp-assemble/regexp-942120.data b/util/regexp-assemble/regexp-942120.data
@@ -0,0 +1,22 @@
+\!\=
+\&\&
+\|\|
+>>
+<<
+>=
+<=
+<>
+<=>
+\bxor\b
+\bregexp\b
+regexp\s+binary
+\bisnull\b
+\brlike\b
+rlike
+rlike\s+binary
+not\s+between\s+0\s+and
+is\s+null
+like\s+null
+^in[+\s]*\([\s\d\"]+[^()]*\)
+\Win[+\s]*\([\s\d\"]+[^()]*\)
+<>\s+binary
diff --git a/util/regexp-assemble/regexp-942130.data b/util/regexp-assemble/regexp-942130.data
@@ -0,0 +1,16 @@
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)=([\s'\"`\(\)]*?)(?:\2)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)<=>([\s'\"`\(\)]*?)(?:\2)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)like([\s'\"`\(\)]*?)(?:\2)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)rlike([\s'\"`\(\)]*?)(?:\2)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)sounds\s+like([\s'\"`\(\)]*?)(?:\2)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)regexp([\s'\"`\(\)]*?)(?:\2)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)!=([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)<=([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)>=([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)<>([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)<([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)>([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)\^([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)is\s+not([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)not\s+like([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
+([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)not\s+regexp([\s'\"`\(\)]*?)(?!\2)([\d\w]+)
diff --git a/util/regexp-assemble/regexp-942140.data b/util/regexp-assemble/regexp-942140.data
@@ -0,0 +1,25 @@
+database\W*\(
+db_name\W*\(
+information_schema\b
+master\.\.sysdatabases\b
+msdb\b
+msysaccessobjects\b
+msysaccessstorage\b
+msysaccessxml\b
+msysaces\b
+msysmodules2\b
+msysmodules\b
+msysobjects\b
+msysqueries\b
+msysrelationships\b
+mysql\.db\b
+northwind\b
+pg_catalog\b
+pg_toast\b
+schema_name\b
+schema\W*\(
+sqlite_master\b
+sqlite_temp_master\b
+sysaux\b
+sys\.database_name\b
+tempdb\b
diff --git a/util/regexp-assemble/regexp-942170.data b/util/regexp-assemble/regexp-942170.data
@@ -0,0 +1,6 @@
+select\s+benchmark\s*?\(\s*?[(]?\s*?\w+
+;\s+benchmark\s*?\(\s*?[(]?\s*?\w+
+select\s+if\s*?\(\s*?[(]?\s*?\w+
+;\s+if\s*?\(\s*?[(]?\s*?\w+
+select\s+sleep\s*?\(\s*?[(]?\s*?\w+
+;\s+sleep\s*?\(\s*?[(]?\s*?\w+
diff --git a/util/regexp-assemble/regexp-942180.data b/util/regexp-assemble/regexp-942180.data
@@ -0,0 +1,21 @@
+\d[\"'`]\s+[\"'`]\s+\d
+^admin\s*?[\"'`]
+(\/\*)+[\"'`]+\s?
+(\/\*)+[\"'`]+\s?--
+(\/\*)+[\"'`]+\s?#
+(\/\*)+[\"'`]+\s?\/\*
+(\/\*)+[\"'`]+\s?{
+[\"'`]\s*?or[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]
+[\"'`]\s*?xor[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]
+[\"'`]\s*?div[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]
+[\"'`]\s*?like[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]
+[\"'`]\s*?between[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]
+[\"'`]\s*?and[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]
+[\"'`]\s*?[^\w\s]?=\s*?[\"'`]
+[\"'`]\W*?[+=]+\W*?[\"'`]
+[\"'`]\s*?[!=|][\d\s!=+-]+.*?[\"'`(].*?$
+[\"'`]\s*?[!=|][\d\s!=]+.*?\d+$
+[\"'`]\s*?like\W+[\w\"'`(]
+\sis\s*?0\W
+where\s[\s\w\.,-]+\s=
+[\"'`][<>~]+[\"'`]
diff --git a/util/regexp-assemble/regexp-942190.data b/util/regexp-assemble/regexp-942190.data
@@ -0,0 +1,20 @@
+[\"'`]\s*?!\s*?[\"'`\w]
+[\"'`];?\s*?having\b\s*?[^\s]
+[\"'`];?\s*?select\b\s*?[^\s]
+[\"'`];?\s*?union\b\s*?[^\s]
+\s*?exec.*?\Wxp_cmdshell
+\s*?execute.*?\Wxp_cmdshell
+\wiif\s*?\(
+connection_id\s*?\([^\)]*?
+current_user\s*?\([^\)]*?
+database\s*?\([^\)]*?
+exec\s+master\.
+execute\s+master\.
+from\W+information_schema\W
+into[\s+]+dumpfile\s*?[\"'`]
+into[\s+]+outfile\s*?[\"'`]
+schema\s*?\([^\)]*?
+select.*?\w?user\(
+union select @
+union[\w(\s]*?select
+user\s*?\([^\)]*?
diff --git a/util/regexp-assemble/regexp-942200.data b/util/regexp-assemble/regexp-942200.data
@@ -0,0 +1,14 @@
+,.*?[)\da-f\"'`][\"'`][\"'`].*?[\"'`]
+,.*?[)\da-f\"'`][\"'`]\Z
+,.*?[)\da-f\"'`][\"'`][^\"'`]+
+\Wselect.+\W*?from
+select\s*?\(\s*?space\s*?\(
+create\s*?\(\s*?space\s*?\(
+rename\s*?\(\s*?space\s*?\(
+truncate\s*?\(\s*?space\s*?\(
+load\s*?\(\s*?space\s*?\(
+alter\s*?\(\s*?space\s*?\(
+delete\s*?\(\s*?space\s*?\(
+update\s*?\(\s*?space\s*?\(
+insert\s*?\(\s*?space\s*?\(
+desc\s*?\(\s*?space\s*?\(
diff --git a/util/regexp-assemble/regexp-942210.data b/util/regexp-assemble/regexp-942210.data
@@ -0,0 +1,40 @@
+@.+=\s*?\(\s*?select
+\d+\s*?or\s*?\d+\s*?[\-+]
+\d+\s*?xor\s*?\d+\s*?[\-+]
+\d+\s*?div\s*?\d+\s*?[\-+]
+\d+\s*?like\s*?\d+\s*?[\-+]
+\d+\s*?between\s*?\d+\s*?[\-+]
+\d+\s*?and\s*?\d+\s*?[\-+]
+\/\w+;?\s+having\W
+\/\w+;?\s+and\W
+\/\w+;?\s+or\W
+\/\w+;?\s+xor\W
+\/\w+;?\s+div\W
+\/\w+;?\s+like\W
+\/\w+;?\s+between\W
+\/\w+;?\s+select\W
+\d\s+group\s+by.+\(
+;\s*?drop
+#\s*?drop
+--\s*?drop
+;\s*?alter
+#\s*?alter
+--\s*?alter
+;\s*?update\s*?\w{2,}
+#\s*?update\s*?\w{2,}
+--\s*?update\s*?\w{2,}
+;\s*?insert\s*?\w{2,}
+#\s*?insert\s*?\w{2,}
+--\s*?insert\s*?\w{2,}
+[^\w]SET\s*?@\w+
+and[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+nand[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+or[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+xor[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+xxor[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+div[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+like[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+between[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+not[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+\|\|[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
+\&\&[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]
diff --git a/util/regexp-assemble/regexp-942240.data b/util/regexp-assemble/regexp-942240.data
@@ -0,0 +1,5 @@
+alter\s*?\w+.*?character\s+set\s+\w+
+alter\s*?\w+.*?char\s+set\s+\w+
+[\"'`];*?\s*?waitfor\s+time\s+[\"'`]
+[\"'`];*?\s*?waitfor\s+delay\s+[\"'`]
+[\"'`];.*?:\s*?goto
diff --git a/util/regexp-assemble/regexp-942260.data b/util/regexp-assemble/regexp-942260.data
@@ -0,0 +1,22 @@
+union\s*?\s*?[([]*?\s*?select\s+
+union\s*?all\s*?[([]*?\s*?select\s+
+union\s*?distinct\s*?[([]*?\s*?select\s+
+union\s*?[(!@]*?\s*?[([]*?\s*?select\s+
+\w+\s+like\s+[\"'`]
+like\s*?[\"'`]\%
+[\"'`]\s*?like\W*?[\"'`\d]
+[\"'`]\s*?and\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?nand\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?or\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?xor\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?xxor\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?div\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?like\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?between\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?not\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?\|\|\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?\&\&\s+[\s\w]+=\s*?\w+\s*?having\s+
+[\"'`]\s*?\*\s*?\w+\W+[\"'`]
+[\"'`]\s*?[^?\w\s=.,;)(]+\s*?[(@\"'`]*?\s*?\w+\W+\w
+select\s+?[\[\]()\s\w\.,\"'`-]+from\s+
+find_in_set\s*?\(
diff --git a/util/regexp-assemble/regexp-942280.data b/util/regexp-assemble/regexp-942280.data
@@ -0,0 +1,7 @@
+select\s*?pg_sleep
+waitfor\s*?delay\s?[\"'`]+\s?\d
+;\s*?shutdown\s*?;
+;\s*?shutdown\s*?--
+;\s*?shutdown\s*?#
+;\s*?shutdown\s*?\/\*
+;\s*?shutdown\s*?{
diff --git a/util/regexp-assemble/regexp-942300.data b/util/regexp-assemble/regexp-942300.data
@@ -0,0 +1,18 @@
+\)\s*?when\s*?\d+\s*?then
+[\"'`]\s*?#
+[\"'`]\s*?--
+[\"'`]\s*?{
+\/\*!\s?\d+
+char\s*?\(\s*?\d
+chr\s*?\(\s*?\d
+and\s+\s*?\w+\(
+nand\s+\s*?\w+\(
+or\s+\s*?\w+\(
+xor\s+\s*?\w+\(
+xxor\s+\s*?\w+\(
+div\s+\s*?\w+\(
+like\s+\s*?\w+\(
+between\s+\s*?\w+\(
+not\s+\s*?\w+\(
+\|\|\s+\s*?\w+\(
+\&\&\s+\s*?\w+\(
diff --git a/util/regexp-assemble/regexp-942310.data b/util/regexp-assemble/regexp-942310.data
@@ -0,0 +1,15 @@
+[\"'`]\s+and\s*?=\W
+\(\s*?select\s*?\w+\s*?\(
+\*\/from
+\+\s*?\d+\s*?\+\s*?@
+\w[\"'`]\s*?(?:[-+=|@]+\s+?)+[\d(]
+\w[\"'`]\s*?[-+=|@]+[\d(]
+coalesce\s*?\(
+@@\w+\s*?[^\w\s]
+\W!+[\"'`]\w
+[\"'`];\s*?if
+[\"'`];\s*?while
+[\"'`];\s*?begin
+[\"'`][\s\d]+=\s*?\d
+order\s+by\s+if\w*?\s*?\(
+[\s(]+case\d*?\W.+[tw]hen[\s(]
diff --git a/util/regexp-assemble/regexp-942320.data b/util/regexp-assemble/regexp-942320.data
@@ -0,0 +1,7 @@
+create\s+function\s*?\w+\s*?\(\s*?\)\s*?-
+create\s+procedure\s*?\w+\s*?\(\s*?\)\s*?-
+declare[^\w]+[@#]\s*?\w+
+exec\s*?\(\s*?@
+procedure\s+analyse\s*?\(
+;\s*?declare\s+[\w-]+
+;\s*?open\s+[\w-]+
diff --git a/util/regexp-assemble/regexp-942330.data b/util/regexp-assemble/regexp-942330.data
@@ -0,0 +1,46 @@
+[\"'`]\s*?or\s*?[\"'`]?\d
+[\"'`]\s*?xor\s*?[\"'`]?\d
+[\"'`]\s*?div\s*?[\"'`]?\d
+[\"'`]\s*?like\s*?[\"'`]?\d
+[\"'`]\s*?between\s*?[\"'`]?\d
+[\"'`]\s*?and\s*?[\"'`]?\d
+\\\\x(?:23|27|3d)
+^.?[\"'`]$
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?and\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?nand\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?or\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?xor\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?xxor\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?div\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?like\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?between\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?not\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?\|\|\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[\d\"'`]+)+\s*?\&\&\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?and\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?nand\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?or\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?xor\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?xxor\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?div\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?like\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?between\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?not\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?\|\|\s*?[\w\"'`][+&!@(),.-]
+(?:^[\"'`\\\\]*?[^\"'`]+[\"'`])+\s*?\&\&\s*?[\w\"'`][+&!@(),.-]
+[^\w\s]\w+\s*?[|-]\s*?[\"'`]\s*?\w
+@\w+\s+and\s*?[\"'`\d]+
+@\w+\s+or\s*?[\"'`\d]+
+@\w+\s+xor\s*?[\"'`\d]+
+@\w+\s+div\s*?[\"'`\d]+
+@\w+\s+like\s*?[\"'`\d]+
+@\w+\s+between\s*?[\"'`\d]+
+@[\w-]+\sand\s*?[^\w\s]
+@[\w-]+\sor\s*?[^\w\s]
+@[\w-]+\sxor\s*?[^\w\s]
+@[\w-]+\sdiv\s*?[^\w\s]
+@[\w-]+\slike\s*?[^\w\s]
+@[\w-]+\sbetween\s*?[^\w\s]
+[^\w\s:]\s*?\d\W+[^\w\s]\s*?[\"'`].
+\Winformation_schema
+table_name\W
diff --git a/util/regexp-assemble/regexp-942340.data b/util/regexp-assemble/regexp-942340.data
@@ -0,0 +1,17 @@
+in\s*?[(]+\s*?select
+(?i:n?and|x?x?or|div|like|between|not|\|\||\&\&)\s+[\s\w+]+regexp\s*?\(
+(?i:n?and|x?x?or|div|like|between|not|\|\||\&\&)\s+[\s\w+]+sounds\s+like\s*?[\"'`]
+(?i:n?and|x?x?or|div|like|between|not|\|\||\&\&)\s+[\s\w+]+[=\d]+x
+[\"'`]\s*?\d\s*?--
+[\"'`]\s*?\d\s*?#
+[\"'`][\%&<>^=]+\d\s*?=
+[\"'`][\%&<>^=]+\d\s*?or
+[\"'`][\%&<>^=]+\d\s*?xor
+[\"'`][\%&<>^=]+\d\s*?div
+[\"'`][\%&<>^=]+\d\s*?like
+[\"'`][\%&<>^=]+\d\s*?between
+[\"'`][\%&<>^=]+\d\s*?and
+[\"'`]\W+[\w+-]+\s*?=\s*?\d\W+[\"'`]
+[\"'`]\s*?is\s*?\d.+[\"'`]?\w
+[\"'`][|]?[\w-]{3,}[^\w\s.,]+[\"'`]
+[\"'`]\s*?is\s*?[\d.]+\s*?\W.*?[\"'`]
diff --git a/util/regexp-assemble/regexp-942350.data b/util/regexp-assemble/regexp-942350.data
@@ -0,0 +1,11 @@
+create\s+function\s+.+\s+returns
+;\s*?alter\s*?[\[(]?\w{2,}
+;\s*?create\s*?[\[(]?\w{2,}
+;\s*?delete\s*?[\[(]?\w{2,}
+;\s*?desc\s*?[\[(]?\w{2,}
+;\s*?insert\s*?[\[(]?\w{2,}
+;\s*?load\s*?[\[(]?\w{2,}
+;\s*?rename\s*?[\[(]?\w{2,}
+;\s*?select\s*?[\[(]?\w{2,}
+;\s*?truncate\s*?[\[(]?\w{2,}
+;\s*?update\s*?[\[(]?\w{2,}
diff --git a/util/regexp-assemble/regexp-942360.data b/util/regexp-assemble/regexp-942360.data
@@ -0,0 +1,45 @@
+alter\s+char\s?[(]?
+alter\s+group_concat\s?[(]?
+alter\s+load_file\s?[(]?
+create\s+char\s?[(]?
+create\s+group_concat\s?[(]?
+create\s+load_file\s?[(]?
+delete\s+char\s?[(]?
+delete\s+group_concat\s?[(]?
+delete\s+load_file\s?[(]?
+desc\s+char\s?[(]?
+desc\s+group_concat\s?[(]?
+desc\s+load_file\s?[(]?
+insert\s+char\s?[(]?
+insert\s+group_concat\s?[(]?
+insert\s+load_file\s?[(]?
+load\s+char\s?[(]?
+load\s+group_concat\s?[(]?
+load\s+load_file\s?[(]?
+rename\s+char\s?[(]?
+rename\s+group_concat\s?[(]?
+rename\s+load_file\s?[(]?
+select\s+char\s?[(]?
+select\s+group_concat\s?[(]?
+select\s+load_file\s?[(]?
+truncate\s+char\s?[(]?
+truncate\s+group_concat\s?[(]?
+truncate\s+load_file\s?[(]?
+update\s+char\s?[(]?
+update\s+group_concat\s?[(]?
+update\s+load_file\s?[(]?
+end\s*?\);
+[\s(]load_file\s*?\(
+[\"'`]\s+regexp\W
+[\d\W]\s+as\s*?[\"'`\w]+\s*?from
+^[\W\d]+\s*?alter\b
+^[\W\d]+\s*?create\b
+^[\W\d]+\s*?delete\b
+^[\W\d]+\s*?desc\b
+^[\W\d]+\s*?insert\b
+^[\W\d]+\s*?load\b
+^[\W\d]+\s*?rename\b
+^[\W\d]+\s*?select\b
+^[\W\d]+\s*?truncate\b
+^[\W\d]+\s*?union\b
+^[\W\d]+\s*?update\b
diff --git a/util/regexp-assemble/regexp-942370.data b/util/regexp-assemble/regexp-942370.data
diff --git a/util/regexp-assemble/regexp-942380.data b/util/regexp-assemble/regexp-942380.data
diff --git a/util/regexp-assemble/regexp-942390.data b/util/regexp-assemble/regexp-942390.data
diff --git a/util/regexp-assemble/regexp-942400.data b/util/regexp-assemble/regexp-942400.data
diff --git a/util/regexp-assemble/regexp-942410.data b/util/regexp-assemble/regexp-942410.data
diff --git a/util/regexp-assemble/regexp-942470.data b/util/regexp-assemble/regexp-942470.data
diff --git a/util/regexp-assemble/regexp-942480.data b/util/regexp-assemble/regexp-942480.data
